CVE-2026-96620: A Dash-Leading Resume ID in the Claude Agent SDK for Python Became a CLI Flag That Defined a Command-Running MCP Server (CVSS 9.2)

Anthropic published GHSA-h4mw-j7qp-8mwm for the Claude Agent SDK for Python (claude-agent-sdk on PyPI) on 12 September 2026, rated critical, and NVD published it as CVE-2026-96620 on 16 October with GitHub as CNA and a CVSS 4.0 score of 9.2. Before 0.2.121 the SDK passed its resume option to the Claude Code CLI as a separate argument without validating it, so a session ID that began with a dash was read as a flag of its own. An attacker who controls that value can inject --mcp-config to define a stdio MCP server, and the CLI runs that server's command at startup, outside the SDK's permission controls. It can only be exploited where an application passes untrusted input, such as a session ID taken from a request or a URL, as the resume value. The fix is in 0.2.121 (PR 1123). No exploitation has been reported. Scanners keyed on the CVE will only have flagged it since October, about a month after the advisory.

You are affected if you run claude-agent-sdk <0.2.121. Versions 0.2.121 and later include the fix.

Upgrade claude-agent-sdk to 0.2.121 or later (0.2.168 was current on 19 October 2026). In applications built on the SDK, never pass user-supplied values straight to resume: accept only session IDs your application issued, check them against the expected format and reject anything that starts with a dash, and look the real ID up server-side. On hosts that run SDK-based services, review for unexpected --mcp-config arguments, MCP server definitions or child processes started by the Claude CLI.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run claude-agent-sdk and which version, then enforce a policy on it.